Article 36*

Article 36 – Derogations

Commission Proposal

By way of derogation from Articles 34 and 35, Member States shall provide that a transfer of personal data to a third country or an international organisation may take place only on condition that:

(a) the transfer is necessary in order to protect the vital interests of the data subject or another person; or

(b) the transfer is necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides; or

(c) the transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country; or

(d) the transfer is necessary in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; or

(e) the transfer is necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal penalty.

EDRi’s proposed amendment

1. By way of derogation from Articles 34 and 35, Member States shall provide that a transfer of personal data to a competent public authority in a third country or an international organisation may take place only on condition that the controller has obtained prior authorisation in accordance with paragraph 1a and:

(a) the transfer is necessary in order to protect the vital interests of the data subject or another person; or

(b) the transfer is necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides; or

(c) the transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country; or

(d) the transfer is necessary in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; or

(e) the transfer is necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal penalty.

1a. Member States shall provide that prior to carrying out a transfer based on paragraph 1, the controller shall obtain prior authorisation from the supervisory authority, in order to ensure the compliance of the transfer with the provisions adopted pursuant to this Directive and to in particular to mitigate the risk involved for the data  subject.

1b. Member States shall provide that when any of the derogations in paragraph 1 is invoked, the controller shall:

(a) only transfer the amount of personal data strictly necessary to achieve the aim of the transfer; and

(b) document these transfers, including the date and time of the transfer, information about the recipient authority, the justification for the transfer and the data transferred. This documentation shall be made available to the supervisory authority on request.

Justification

The use of such derogations should be restricted to the minimum amount of personal data and should be properly documented. In any case, the controller should obtain prior authorisation from the supervisory authority. The paragraph on prior authorisation is inspired by Article 34(1) of the proposed general data protection Regulation.

  • eu logo The launch and upkeep (until December 31, 2013) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: